This is what a random website knows about you.
A CAPTCHA that shows you your own data exhaust instead of hiding it.
Pick one:
- [A] Solve a puzzle — the traditional way.
- [B] Open the intel dashboard on yourself — see what any website already sees.
Path B renders a live SIGINT-style dashboard of everything the page can read from your browser with zero permission prompts: GPU model, CPU cores, battery level and drain rate, screen geometry, timezone, language list, microphone and camera counts, canvas fingerprint, IP, city, ISP and ASN.
Most people's reaction is unprintable. That's the point.
Privacy fingerprinting demos already exist — EFF's Cover Your Tracks, amiunique.org, browserleaks — but they're all destination sites. You only visit them if you already care. A CAPTCHA is pushed to people who don't, at a moment they can't skip. That's the difference between preaching to the converted and running an actual awareness campaign.
index.html is a gallery of ten complete takes on the same idea, navigable by hash
(#v1 … #v10, arrows to switch, Esc back to the grid):
| version | aesthetic | |
|---|---|---|
| v1 | War Room | SIGINT threat-monitor: exposure dial, live ticker, CRT scanlines |
| v2 | Kunsthalle | Swiss editorial — the exposure score as gallery artwork |
| v3 | The Receipt | thermal printer; every signal rung up FREE, total: your privacy |
| v4 | The Dossier | classified case file; redaction bars lift to show nothing was secret |
| v5 | Onboarding | cheerful setup wizard whose emoji turn cold |
| v6 | Boarding Pass | e-passport with an MRZ strip encoding your fingerprint |
| v7 | CRT Boot | green phosphor terminal running a "subject scan" |
| v8 | The Daily Leak | tabloid front page, headline composed live from your data |
| v9 | It's a Match | the website has a crush on you and already knows everything |
| v10 | Vitals | patient monitor; battery is the heartbeat, exposure the blood pressure |
Every version reads from one shared collector (engine.js) and renders the identical
snapshot, so only the design varies — never the facts. Each is a single file with
exactly one external reference (the engine) and no CDN, font, or image requests.
robots.html is a side gallery: 100 procedurally generated robots, each assembled
from a seeded parts vocabulary and drawn stroke by stroke with a glowing tip
travelling along every line. A gallery of robots, for a page whose job is asking
whether you are one.
python3 -m http.server 8000Then open http://localhost:8000.
Opening index.html directly over file:// works too, but the IP geolocation
panel will be blocked by CORS.
No build step, no dependencies, no framework. One HTML file.
Nothing.
Every signal is read client-side and discarded when you close the tab. There is no
database, no analytics, no cookie, no localStorage write. The only outbound
request is the IP lookup to ipapi.co — made by your browser, not by a server —
and that third party necessarily sees your IP, as does every server you ever
connect to. The page says so on its face rather than quietly claiming purity.
That constraint isn't a limitation, it's the entire argument. A privacy-awareness page that retained device fingerprints would just be a tracker with better typography.
- ePrivacy Art. 5(3) / UK PECR Reg. 6 governs this, not just GDPR. It covers gaining access to information stored in terminal equipment — which is what reading canvas, WebGL and battery is — regardless of whether anything is stored or whether the data is personal data.
- The explicit click on path [B] is what makes this defensible: reading the device is the service the user just requested, which fits the "strictly necessary for a service explicitly requested by the user" exemption. The scan must therefore never run on page load. Keep the puzzle path.
- Fingerprint hashes are not anonymous. Their purpose is singling out, and the input space is small enough to brute-force. Retaining them means holding pseudonymous personal data under full GDPR — lawful basis, retention limits, DSARs, DPIA. Hence: store nothing.
- The ICO's final guidance on storage and access technologies treats fingerprinting as engaging PECR consent requirements, and the ICO has publicly criticised fingerprinting for advertising as unfair.
- Client-side "1 in N" uniqueness counter — compare a locally computed fingerprint against a published static distribution file, so the number is real and still nothing is transmitted.
- Replace
ipapi.cowith Cloudflare Workers'request.cf(city, ASN, datacenter-vs-residential, no third party, no rate limit) or self-hosted MaxMind GeoLite2. The freeipapi.cotier forbids production use. - Measure the [A] vs [B] split by region — a revealed-preference study of privacy norms, which vary by country as much as content norms do.
- Embeddable widget + verification token, so it can gate a real form.
MIT